Privacy Policy

1. Who we are

Intrida Limited is a private limited company incorporated in England & Wales on 17 May 2018 under company number 11367960. We develop business software (SIC 62012) and publish software products (SIC 58290).

2. Controller and processor

UK GDPR separates the organisation that decides how and why personal data is used (the controller) from one that only acts on instructions given by someone else (the processor). We are each of these in different contexts, and which applies affects who you should contact.

Where we are the controller

For our own business records — enquiries sent to us, client and supplier contacts, correspondence, contracts, invoicing and this website — we decide what is collected and why. This policy governs that data and you should contact us about it directly.

Where we are the processor

Software we build or publish for a client often holds personal data belonging to that client's own customers, staff or users. In that situation the client is the controller and we act only on their documented instructions. We do not decide what that data is used for, do not use it for our own purposes, and do not disclose it except as the client instructs or the law requires.

Every processor engagement is covered by a written data processing agreement meeting Article 28 of UK GDPR: subject matter and duration, purpose, categories of data, security measures, use of sub-processors, assistance with rights requests, breach notification, and deletion or return of data when the contract ends.

During development and support we try to work with test or anonymised data. Where access to live data is unavoidable, it is limited to named individuals, logged, and ends when the work does.

3. What we collect

As a controller we hold the following, and no more than we need:

Enquiries

• Name, email address, telephone number and organisation
• The content of your enquiry and our correspondence about it

Clients and project contacts

• Name, job title and work contact details
• Requirements, specifications, meeting notes and support tickets that name individuals
• Accounts we issue for access to development, staging or licensed environments, and audit records of their use
• Billing contacts, purchase orders and invoice history

Suppliers and contractors

• Contact details, contracts and compliance documentation
• Payment details and invoice history

Website visitors

• IP address, browser and device type, pages requested, date and time — in standard server logs
• Anything you choose to include when you email us

We do not seek special category data (health, biometrics, political or religious beliefs and similar) for our own purposes. Where such data exists inside software we build or publish for a client, we handle it as a processor under section 2.

4. How we collect it

• Directly from you — by email, by telephone, in meetings or through a contract
• From colleagues at your organisation who introduce you as a project contact
• From public business sources such as a company website or the Companies House register
• Automatically through server logs when you visit this website
• From systems we operate, where issuing or using an account generates an audit record

5. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded it does not override them. You can object at any time — see section 9 — and any update we send carries an unsubscribe link.

6. Who we share it with

We disclose personal data only where there is a reason, and only as much as is needed:

• Infrastructure and cloud suppliers — who host development, staging and release systems
• Software and tooling suppliers — email, source control, issue tracking, error monitoring, backup
• Subcontractors — specialists brought onto a project, bound by equivalent confidentiality and data protection terms
• Distribution and licensing platforms — where a published product reaches users through them
• Accountants, auditors and payment providers — for billing and statutory accounts
• Professional advisers and insurers — where we need advice or must notify a claim
• Regulators, courts and law enforcement — where the law obliges us

We do not sell personal data and we do not share it for third-party marketing. Suppliers who process data on our behalf act only on our written instructions. Where we act as a processor for a client, we engage sub-processors only with that client's authorisation and remain answerable to them for what a sub-processor does.

7. International transfers

We prefer to keep personal data in the United Kingdom or the European Economic Area. Where a supplier stores or accesses it elsewhere, we rely on one of the following:

• UK adequacy regulations covering the destination country, or
• The UK International Data Transfer Agreement, or EU standard contractual clauses with the UK Addendum, supported by a transfer risk assessment, or
• Another safeguard permitted by UK data protection law

For client projects, the locations where data is held are set out in the contract and are not changed without notice. Ask us which safeguard covers a particular transfer and we will tell you.

8. How long we keep it

At the end of a period we delete data securely or anonymise it. Where data has been copied into a backup, deletion takes effect when that backup is overwritten in the ordinary cycle; until then it is not used for any purpose.

9. Your rights

Where we are the controller, you have the right to:

• Be informed — which is what this policy does
• Access your personal data and receive a copy
• Rectification of anything inaccurate or incomplete
• Erasure, where we have no continuing reason to hold it
• Restrict processing while something is checked or disputed
• Data portability — receive data you gave us in a structured, machine-readable format
• Object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent where we rely on it, without affecting earlier processing

Write to info@intridalimited.online. We reply within one month, at no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity first.

Where we act as a processor, send your request to the organisation whose software holds the data. We will assist them in answering it, as our agreement requires.

10. Automated decisions

We do not make decisions about you by automated means alone, and we carry out no profiling with legal or similarly significant effects. Where software we build for a client performs automated decision-making, that client is the controller and is responsible for informing the people affected.

11. Cookies and this website

This website does not use cookies for analytics, advertising or tracking, and does not profile visitors. The web server keeps standard access logs, which are necessary to operate and secure the site.

If we later add cookies that are not strictly necessary, we will update this policy and ask for your consent first, as the Privacy and Electronic Communications Regulations require.

12. Security

Our technical and organisational measures include:

• Encryption of data in transit, and at rest where the platform supports it
• Role-based access on the principle of least privilege
• Multi-factor authentication on administrative and source control accounts
• Separation of development, staging and production environments
• Code review and dependency monitoring before release
• Logging of administrative actions and monitoring for unusual activity
• Regular patching, backups and tested restore procedures
• Written contracts imposing equivalent duties on suppliers and subcontractors
• Confidentiality obligations and data protection training for everyone who works on client systems

No system can be made completely secure and we do not claim otherwise. We keep these measures under review against the risk.

13. Data breaches

If a personal data breach occurs for which we are the controller and it is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner within 72 hours of becoming aware, and tell the people affected where the risk is high.

Where we are a processor, we notify the client without undue delay after becoming aware, so they can meet their own obligations, and we assist their investigation.

14. Changes to this policy

We review this policy periodically and may update it to reflect changes in our services, our suppliers or the law. The current version is always published at this address with the date of the last update shown at the top. Where a change materially affects how we use your data, we will notify clients directly.

15. Contact and complaints

For any question, concern or rights request, contact us first:

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would welcome the chance to resolve the matter with you first.